| Age | Commit message (Collapse) | Author |
|---|
|
The Key Usage extension is described in section 4.2.1.3 of X.509, with the following possible flags:
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1), -- recent editions of X.509 have
-- renamed this bit to contentCommitment
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
In SSL/TLS, when the server certificate contains a RSA key, then:
either a DHE or ECDHE cipher suite is used, in which case the RSA key
is used for a signature (see section 7.4.3 of RFC 5246: the "Server
Key Exchange" message); this exercises the digitalSignature key usage;
or "plain RSA" is used, with a random value (the 48-byte pre-master
secret) being encrypted by the client with the server's public key
(see section 7.4.7.1 of RFC 5246); this is right in the definition of
the keyEncipherment key usage flag.
dataEncipherment does not apply, because what is encrypted is not
directly meaningful data, but a value which is mostly generated
randomly and used to derive symmetric keys. keyAgreement does not
apply either, because that one is for key agreement algorithms which
are not a case of asymmetric encryption (e.g. Diffie-Hellman). The
keyAgreement usage flag would appear in a certificate which contains a
DH key, not a RSA key. nonRepudiation is not used, because whatever is
signed as part of a SSL/TLS key exchange cannot be used as proof for a
third party (there is nothing in a SSL/TLS tunnel that the client
could record and then use to convince a judge when tring to sue the
server itself; the data which is exchanged within the tunnel is not
signed by the server).
When a ECDSA key is used then "keyAgreement" flag is needed for beeing
ECDH "capable" (as opposed to ephemeral ECDHE)
|
|
* ingela/ssl/testcuddling:
ssl: Exclude DTLS tests for one more OpenSSL version for now
ssl: Use sane input data
ssl: Make sure help function works from all parts of test suite
|
|
* lukas/kernel/logger-docs:
Add xmllint to travis build
kernel: Use formatter in simple logger example
|
|
* maint:
Updated OTP version
Update release notes
Update version numbers
ssl: Prepare for release
ssl: Proper handling of clients that choose to send an empty answer to a certificate request
heart: Use ntohs instead of manual conversion
|
|
* maint-20:
Updated OTP version
Update release notes
Update version numbers
ssl: Prepare for release
ssl: Proper handling of clients that choose to send an empty answer to a certificate request
heart: Use ntohs instead of manual conversion
|
|
|
|
|
|
|
|
|
|
* ingela/ssl/client-has-no-cert/ERL-599/OTP-15050:
ssl: Prepare for release
ssl: Proper handling of clients that choose to send an empty answer to a certificate request
|
|
into maint-20
* john/erts/fix-heart-command-overflow/OTP-15034/ERIERL-166:
heart: Use ntohs instead of manual conversion
# Conflicts:
# lib/kernel/test/heart_SUITE.erl
|
|
Depending on context trap_exit flag may be set or not.
So always set trap_exit and consume the EXIT signal and then set it back.
|
|
This reverts commit 202bb737e3deabfebee683266f4b7c42781eb521.
|
|
This reverts commit 345f7f527a4c26ef49cef0d81e2c8b71bf01ebc3.
|
|
|
|
|
|
|
|
ECDH suite handling did not use the EC parameters form the certs
as expected.
|
|
Fix test case code to use keyAgreement for ECDH_ECDSA
|
|
|
|
Change-Id: Ia53fb6bbf0822608ce9f7afe9b905d3bb1ce0b11
|
|
* ingela/dtls/abbreviated:
dtls: Trigger resend in abbreviated handshake if change_cipher_spec is received to early.
|
|
is received to early.
|
|
* bjorn/compiler/yreg-init:
beam_validator: Verify Y registers in exception-causing instructions
Correct beam_utils:is_killed/3 (again)
|
|
Skip the test cases in the engine_SUITE on a specific ssl version
used on one test machine.
|
|
All corba applications are moved to a separate repository.
E.g. orber, ic, cosEvent, cosEventDomain, cosNotifications
cosTime, cosTransactions, cosProperty and cosFileTransfer.
|
|
* raimo/better-TLS-distribution/OTP-14969:
Fix distro CRL test cases short vs long names
Allow check for node name
Move check ip to before SSL handshake
Check client IP from server
Parse cert primarily for host names
Open for host and node allow list
Create plug-in for distro cert nodes
Rewrite TLS dist to handle node names in certs
Improve node allowed check
|
|
Inets generated test data that not conform to valid TLS cipher suites
|
|
* ingela/ssl/test-cuddle:
ssl: Handle EXIT messages from test code correctly
|
|
|
|
* ingela/inets/httpc-error-handling/ERL-605/OTP-15042:
inets: Improve httpc gracefulness
|
|
|
|
answer to a certificate request
Solves ERL-599
|
|
|
|
|
|
|
|
|
|
When an exception is handled, the stack will be scanned. Therefore
all Y registers must be initialized.
|
|
beam_utils:is_killed/3 could incorrectly indicate that a
register was killed.
The previous fix is 5da6b91ecab6c.
|
|
* siri/kernel/logger/OTP-13295:
Add documentation of the built-in logger handlers
Catch badarg in logger:get_format_depth/0
Add chars_limit option to logger_formatter
Don't kill logger process until all other processes are dead
Set call timeout for logger_server to infinity
Update primary bootstrap
Test cuddle for logger
Update cth_log_redirect to a logger handler
Start using logger internally in kernel and stdlib
Remove error_logger process and add logger process
Add logger
|
|
It is now explicitly stated that if the application type is `load`, the
application will not actually be restarted by the `restart_application`
instruction in relup, even if it is currently running. It will only be stopped
and re-loaded.
|
|
* anders/diameter/21.0/OTP-15045:
vsn -> 2.1.5
Update appup for 21.0
Fix release note typo
Fix documentation typos
|
|
This commit will make the close down sequence work as intended, and no
crash report will be generated. Alas such error corner cases are hard to
write automated test for.
|
|
* hans/ssh/cuddle_tests:
ssh: Test case fix The daemon kill is now so fast that the clients does not react fast enough in ssh_sup_SUITE:killed_acceptor_restarts/1
|
|
* hans/ssh/dbg/OTP-14896:
ssh: Correct a call that re-appeared by misstake
|
|
IngelaAndin/ingela/ssl/client-has-no-cert/ERL-599/OTP-15050
ssl: Proper handling of clients that choose to send an empty answer to a certificate request
|
|
* hasse/stdlib/rfc3339_datetime/OTP-14764:
stdlib: Add RFC 3339 functions to module calendar
|
|
answer to a certificate request
Solves ERL-599
|
|
|
|
|
